ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
authorPeter Ujfalusi <peter.ujfalusi@linux.intel.com>
Tue, 12 Jul 2022 12:23:55 +0000 (15:23 +0300)
committerMark Brown <broonie@kernel.org>
Tue, 12 Jul 2022 12:45:01 +0000 (13:45 +0100)
commitacacd9eefd0def5a83244d88e5483b5f38ee7287
tree7681dedc476439e9d797eb4e38fe815f6ea71b3a
parent388fe2b8a3a0f597b2680e8f1ef5324e1db76ed2
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot

It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.

The issue was reported with IPC4 firmware but the same condition is present
for IPC3.

Reported-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220712122357.31282-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sound/soc/sof/intel/cnl.c